1. Patchew
  2. linux
  3. View series

[PATCH] jfs: check if dmt_leafidx is less than zero

Edward Adam Davis posted 1 patch 1 month, 1 week ago 
fs/jfs/jfs_dmap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
[PATCH] jfs: check if dmt_leafidx is less than zero
Posted by Edward Adam Davis 1 month, 1 week ago 
syzbot report a out of bounds in dbSplit, it because dmt_leafidx less
than 0, add a checking for dmt_leafidx in dbAllocDmapLev.

Reported-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/jfs/jfs_dmap.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cb3cda1390ad..c5b8883599e3 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -1956,6 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp,
 {
 	s64 blkno;
 	int leafidx, rc;
+	dmtree_t *tp = (dmtree_t *) &dp->tree;
 
 	/* can't be more than a dmaps worth of blocks */
 	assert(l2nb <= L2BPERDMAP);
@@ -1964,10 +1965,10 @@ dbAllocDmapLev(struct bmap * bmp,
 	 * free space.  if sufficient free space is found, dbFindLeaf()
 	 * returns the index of the leaf at which free space was found.
 	 */
-	if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
+	if (dbFindLeaf(tp, l2nb, &leafidx, false))
 		return -ENOSPC;
 
-	if (leafidx < 0)
+	if (leafidx < 0 || le32_to_cpu(tp->dmt_leafidx) < 0)
 		return -EIO;
 
 	/* determine the block number within the file system corresponding
-- 
2.43.0
Re: [Jfs-discussion] [PATCH] jfs: check if dmt_leafidx is less than zero
Posted by Dave Kleikamp 1 month, 1 week ago 
On 7/26/24 9:22AM, Edward Adam Davis via Jfs-discussion wrote:
> syzbot report a out of bounds in dbSplit, it because dmt_leafidx less
> than 0, add a checking for dmt_leafidx in dbAllocDmapLev.

This addresses the particular case, but I wonder if it would be a little 
more robust to move the check into dbFindLeaf(). It would also catch a 
similar issue when called from dbFindCtl().

> 
> Reported-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>   fs/jfs/jfs_dmap.c | 5 +++--
>   1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index cb3cda1390ad..c5b8883599e3 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -1956,6 +1956,7 @@ dbAllocDmapLev(struct bmap * bmp,
>   {
>   	s64 blkno;
>   	int leafidx, rc;
> +	dmtree_t *tp = (dmtree_t *) &dp->tree;
>   
>   	/* can't be more than a dmaps worth of blocks */
>   	assert(l2nb <= L2BPERDMAP);
> @@ -1964,10 +1965,10 @@ dbAllocDmapLev(struct bmap * bmp,
>   	 * free space.  if sufficient free space is found, dbFindLeaf()
>   	 * returns the index of the leaf at which free space was found.
>   	 */
> -	if (dbFindLeaf((dmtree_t *) &dp->tree, l2nb, &leafidx, false))
> +	if (dbFindLeaf(tp, l2nb, &leafidx, false))
>   		return -ENOSPC;
>   
> -	if (leafidx < 0)
> +	if (leafidx < 0 || le32_to_cpu(tp->dmt_leafidx) < 0)
>   		return -EIO;
>   
>   	/* determine the block number within the file system corresponding
[PATCH V2] jfs: check if leafidx greater than num leaves per dmap tree
Posted by Edward Adam Davis 1 month, 1 week ago 
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater
than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.

Reported-and-tested-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
 fs/jfs/jfs_dmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cb3cda1390ad..516bac758053 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2976,6 +2976,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 		 */
 		assert(n < 4);
 	}
+	if (le32_to_cpu(tp->dmt_leafidx) >= LPERDMAP)
+		return -ENOSPC;
 
 	/* set the return to the leftmost leaf describing sufficient
 	 * free space.
-- 
2.43.0
Re: [PATCH V2] jfs: check if leafidx greater than num leaves per dmap tree
Posted by Dave Kleikamp 2 weeks, 1 day ago 
On 7/26/24 8:42PM, Edward Adam Davis wrote:
> syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater
> than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
> 
> Reported-and-tested-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
>   fs/jfs/jfs_dmap.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index cb3cda1390ad..516bac758053 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -2976,6 +2976,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
>   		 */
>   		assert(n < 4);
>   	}
> +	if (le32_to_cpu(tp->dmt_leafidx) >= LPERDMAP)
> +		return -ENOSPC;

NACK. It needs to be smarter than this.

dbFindLeaf() can be called with a control page in which dmt_leafidx is 
bound by LPERCTL, which is larger than LPERDMAP.

>   
>   	/* set the return to the leftmost leaf describing sufficient
>   	 * free space.
[PATCH V3] jfs: check if leafidx greater than num leaves per dmap tree
Posted by Edward Adam Davis 2 weeks ago 
syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater
than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.

Reported-and-tested-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
---
V2 -> V3: Exclude control page

 fs/jfs/jfs_dmap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index cb3cda1390ad..516bac758053 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2976,6 +2976,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
 		 */
 		assert(n < 4);
 	}
+	if (!is_ctl && le32_to_cpu(tp->dmt_leafidx) >= LPERDMAP)
+		return -ENOSPC;
 
 	/* set the return to the leftmost leaf describing sufficient
 	 * free space.
-- 
2.43.0
Re: [PATCH V3] jfs: check if leafidx greater than num leaves per dmap tree
Posted by Dave Kleikamp 1 week, 4 days ago 
On 8/23/24 8:25PM, Edward Adam Davis wrote:
> syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater
> than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.
> 
> Reported-and-tested-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
> Signed-off-by: Edward Adam Davis <eadavis@qq.com>
> ---
> V2 -> V3: Exclude control page
> 
>   fs/jfs/jfs_dmap.c | 2 ++
>   1 file changed, 2 insertions(+)
> 
> diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
> index cb3cda1390ad..516bac758053 100644
> --- a/fs/jfs/jfs_dmap.c
> +++ b/fs/jfs/jfs_dmap.c
> @@ -2976,6 +2976,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
>   		 */
>   		assert(n < 4);
>   	}
> +	if (!is_ctl && le32_to_cpu(tp->dmt_leafidx) >= LPERDMAP)
> +		return -ENOSPC;
>   
>   	/* set the return to the leftmost leaf describing sufficient
>   	 * free space.

I was thinking something more along the lines of this.

jfs: check if leafidx greater than num leaves per dmap tree

syzbot report a out of bounds in dbSplit, it because dmt_leafidx greater
than num leaves per dmap tree, add a checking for dmt_leafidx in dbFindLeaf.

Shaggy:
Modified sanity check to apply to control pages as well as leaf pages.

Reported-and-tested-by: syzbot+dca05492eff41f604890@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dca05492eff41f604890
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
---
  fs/jfs/jfs_dmap.c | 5 ++++-
  1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c
index 8847e8c5d5b4..974ecf5e0d95 100644
--- a/fs/jfs/jfs_dmap.c
+++ b/fs/jfs/jfs_dmap.c
@@ -2944,9 +2944,10 @@ static void dbAdjTree(dmtree_t *tp, int leafno, int newval, bool is_ctl)
  static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
  {
  	int ti, n = 0, k, x = 0;
-	int max_size;
+	int max_size, max_idx;
  
  	max_size = is_ctl ? CTLTREESIZE : TREESIZE;
+	max_idx = is_ctl ? LPERCTL : LPERDMAP;
  
  	/* first check the root of the tree to see if there is
  	 * sufficient free space.
@@ -2978,6 +2979,8 @@ static int dbFindLeaf(dmtree_t *tp, int l2nb, int *leafidx, bool is_ctl)
  		 */
  		assert(n < 4);
  	}
+	if (le32_to_cpu(tp->dmt_leafidx) >= max_idx)
+		return -ENOSPC;
  
  	/* set the return to the leftmost leaf describing sufficient
  	 * free space.
-- 
2.46.0

Patchew 2.1-devel-b67e4c2

© 2016 - 2024 Red Hat, Inc.